Merge pull request #1301 from AFLplusplus/dev 4.00c

v4.00c release

19 files changed, 85 insertions, 105 deletions

diff --git a/unicorn_mode/samples/c/Makefile b/unicorn_mode/samples/c/Makefile
index cb491e10..fd6dbe77 100644
--- a/unicorn_mode/samples/c/Makefile
+++ b/unicorn_mode/samples/c/Makefile
@@ -4,29 +4,28 @@
 .POSIX:
 UNAME_S =$(shell uname -s)# GNU make
 UNAME_S:sh=uname -s       # BSD make
-_UNIQ=_QINU_
 
-LIBDIR = ../../unicornafl
+UNICORNAFL_LIB = ../../unicornafl/build
+UNICORN_LIB = ../../unicornafl/unicorn/build
 BIN_EXT =
 AR_EXT = a
 
 # Verbose output?
 V ?= 0
 
-CFLAGS += -Wall -Werror -I../../unicornafl/include
+CFLAGS += -Wall -Werror -I../../unicornafl/unicorn/include -I../../unicornafl/include
 
-LDFLAGS += -L$(LIBDIR) -lpthread -lm
+LDFLAGS += -L$(UNICORNAFL_LIB) -L$(UNICORN_LIB) -lpthread -lm -lunicornafl -lunicorn -lc++
 
-_LRT = $(_UNIQ)$(UNAME_S:Linux=)
-__LRT = $(_LRT:$(_UNIQ)=-lrt)
-LRT = $(__LRT:$(_UNIQ)=)
+ifeq ($(UNAME), Linux)
+# do something Linux-y
+LRT = -lrt
+else
+LRT = 
+endif
 
 LDFLAGS += $(LRT)
 
-_CC = $(_UNIQ)$(CROSS)
-__CC = $(_CC:$(_UNIQ)=$(CC))
-MYCC = $(__CC:$(_UNIQ)$(CROSS)=$(CROSS)gcc)
-
 .PHONY: all clean
 
 all: harness
@@ -34,14 +33,20 @@ all: harness
 clean:
 	rm -rf *.o harness harness-debug
 
-harness.o: harness.c ../../unicornafl/include/unicorn/*.h
-	${MYCC} ${CFLAGS} -O3 -c harness.c
+harness.o: harness.c ../../unicornafl/unicorn/include/unicorn/*.h
+	${CC} ${CFLAGS} -O3 -c harness.c
+
+harness-debug.o: harness.c ../../unicornafl/unicorn/include/unicorn/*.h
+	${CC} ${CFLAGS} -g -c harness.c -o $@
 
-harness-debug.o: harness.c ../../unicornafl/include/unicorn/*.h
-	${MYCC} ${CFLAGS} -g -c harness.c -o $@
+../../unicornafl/build/libunicornafl.a:
+	cd ../.. && ./build_unicorn_support.sh
 
 harness: harness.o
-	${MYCC} -L${LIBDIR} harness.o ../../unicornafl/libunicornafl.a $(LDFLAGS) -o $@
+	${CC} harness.o ../../unicornafl/build/libunicornafl.a $(LDFLAGS) -o $@
 
 debug: harness-debug.o
-	${MYCC} -L${LIBDIR} harness.o ../../unicornafl/libunicornafl.a $(LDFLAGS) -o harness-debug
+	${CC} harness.o ../../unicornafl/build/libunicornafl.a $(LDFLAGS) -o harness-debug
+
+fuzz: harness
+	DYLD_FALLBACK_LIBRARY_PATH="../../unicornafl/unicorn/build" LD_LIBRARY_PATH="../../unicornafl/unicorn/build" ../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@
diff --git a/unicorn_mode/samples/c/harness.c b/unicorn_mode/samples/c/harness.c
index 4bda6e2d..30972ce7 100644
--- a/unicorn_mode/samples/c/harness.c
+++ b/unicorn_mode/samples/c/harness.c
@@ -8,7 +8,7 @@
 
    Run under AFL as follows:
 
-   $ cd <afl_path>/unicorn_mode/samples/simple/
+   $ cd <afl_path>/unicorn_mode/samples/c
    $ make
    $ ../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@
 */
@@ -26,6 +26,7 @@
 #include <sys/mman.h>
 
 #include <unicorn/unicorn.h>
+#include <unicornafl/unicornafl.h>
 
 // Path to the file containing the binary to emulate
 #define BINARY_FILE ("persistent_target_x86_64")
@@ -141,7 +142,7 @@ static void mem_map_checked(uc_engine *uc, uint64_t addr, size_t size, uint32_t
     //printf("SIZE %llx, align: %llx\n", size, ALIGNMENT);
     uc_err err = uc_mem_map(uc, addr, size, mode);
     if (err != UC_ERR_OK) {
-        printf("Error mapping %ld bytes at 0x%lx: %s (mode: %d)\n", size, addr, uc_strerror(err), mode);
+        printf("Error mapping %ld bytes at 0x%llx: %s (mode: %d)\n", size, (unsigned long long) addr, uc_strerror(err), (int) mode);
         exit(1);
     }
 }
@@ -184,7 +185,7 @@ int main(int argc, char **argv, char **envp) {
 
     // Map memory.
     mem_map_checked(uc, BASE_ADDRESS, len, UC_PROT_ALL);
-    printf("Len: %lx\n", len);
+    printf("Len: %lx\n", (unsigned long) len);
     fflush(stdout);
 
     // write machine code to be emulated to memory
diff --git a/unicorn_mode/samples/compcov_x64/compcov_test_harness.py b/unicorn_mode/samples/compcov_x64/compcov_test_harness.py
index f0749d1b..52f0a286 100644
--- a/unicorn_mode/samples/compcov_x64/compcov_test_harness.py
+++ b/unicorn_mode/samples/compcov_x64/compcov_test_harness.py
@@ -10,7 +10,7 @@
 
    Run under AFL as follows:
 
-   $ cd <afl_path>/unicorn_mode/samples/simple/
+   $ cd <afl_path>/unicorn_mode/samples/python_simple
    $ AFL_COMPCOV_LEVEL=2 ../../../afl-fuzz -U -m none -i ./sample_inputs -o ./output -- python compcov_test_harness.py @@
 """
 
diff --git a/unicorn_mode/samples/persistent/Makefile b/unicorn_mode/samples/persistent/Makefile
index 80a47550..35584416 100644
--- a/unicorn_mode/samples/persistent/Makefile
+++ b/unicorn_mode/samples/persistent/Makefile
@@ -4,29 +4,28 @@
 .POSIX:
 UNAME_S =$(shell uname -s)# GNU make
 UNAME_S:sh=uname -s       # BSD make
-_UNIQ=_QINU_
 
-LIBDIR = ../../unicornafl
+UNICORNAFL_LIB = ../../unicornafl/build
+UNICORN_LIB = ../../unicornafl/unicorn/build
 BIN_EXT =
 AR_EXT = a
 
 # Verbose output?
 V ?= 0
 
-CFLAGS += -Wall -Werror -I../../unicornafl/include
+CFLAGS += -Wall -Werror -I../../unicornafl/unicorn/include -I../../unicornafl/include
 
-LDFLAGS += -L$(LIBDIR) -lpthread -lm
+LDFLAGS += -L$(UNICORNAFL_LIB) -L$(UNICORN_LIB) -lpthread -lm -lunicornafl -lunicorn -lc++
 
-_LRT = $(_UNIQ)$(UNAME_S)
-__LRT = $(_LRT:$(_UNIQ)Linux=-lrt)
-LRT = $(__LRT:$(_UNIQ)$(UNAME_S)=)
+ifeq ($(UNAME), Linux)
+# do something Linux-y
+LRT = -lrt
+else
+LRT = 
+endif
 
 LDFLAGS += $(LRT)
 
-_CC = $(_UNIQ)$(CROSS)
-__CC = $(_CC:$(_UNIQ)=$(CC))
-MYCC = $(__CC:$(_UNIQ)$(CROSS)=$(CROSS)gcc)
-
 .PHONY: all clean
 
 all: harness
@@ -34,20 +33,23 @@ all: harness
 clean:
 	rm -rf *.o harness harness-debug
 
-harness.o: harness.c ../../unicornafl/include/unicorn/*.h
-	${MYCC} ${CFLAGS} -O3 -c harness.c
+harness.o: harness.c ../../unicornafl/unicorn/include/unicorn/*.h
+	${CC} ${CFLAGS} -O3 -c harness.c
 
-harness-debug.o: harness.c ../../unicornafl/include/unicorn/*.h
-	${MYCC} ${CFLAGS} -DAFL_DEBUG=1 -g -c harness.c -o $@
+harness-debug.o: harness.c ../../unicornafl/unicorn/include/unicorn/*.h
+	${CC} ${CFLAGS} -DAFL_DEBUG=1 -g -c harness.c -o $@
 
 harness: harness.o
-	${MYCC} -L${LIBDIR} harness.o ../../unicornafl/libunicornafl.a $(LDFLAGS) -o $@
+	${CC} harness.o ../../unicornafl/build/libunicornafl.a $(LDFLAGS) -o $@
 
 debug: harness-debug.o
-	${MYCC} -L${LIBDIR} harness-debug.o ../../unicornafl/libunicornafl.a $(LDFLAGS) -o harness-debug
+	${CC} harness-debug.o ../../unicornafl/build/libunicornafl.a $(LDFLAGS) -o harness-debug
+
+../../unicornafl/build/libunicornafl.a:
+	cd ../.. && ./build_unicorn_support.sh
 
 fuzz: harness
-	../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@
+	DYLD_FALLBACK_LIBRARY_PATH="../../unicornafl/unicorn/build" LD_LIBRARY_PATH="../../unicornafl/unicorn/build" ../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@
 
 debugmake:
 	@echo UNAME_S=$(UNAME_S), _LRT=$(_LRT), __LRT=$(__LRT), LRT=$(LRT)
diff --git a/unicorn_mode/samples/persistent/harness.c b/unicorn_mode/samples/persistent/harness.c
index eae3f1fc..37b652e0 100644
--- a/unicorn_mode/samples/persistent/harness.c
+++ b/unicorn_mode/samples/persistent/harness.c
@@ -30,6 +30,7 @@
 #include <sys/mman.h>
 
 #include <unicorn/unicorn.h>
+#include <unicornafl/unicornafl.h>
 
 // Path to the file containing the binary to emulate
 #define BINARY_FILE ("persistent_target_x86_64")
diff --git a/unicorn_mode/samples/simple/COMPILE.md b/unicorn_mode/samples/python_simple/COMPILE.md
index f7bf5b50..f7bf5b50 100644
--- a/unicorn_mode/samples/simple/COMPILE.md
+++ b/unicorn_mode/samples/python_simple/COMPILE.md
diff --git a/unicorn_mode/samples/simple/sample_inputs/sample1.bin b/unicorn_mode/samples/python_simple/sample_inputs/sample1.bin
index 85df5078..85df5078 100644
--- a/unicorn_mode/samples/simple/sample_inputs/sample1.bin
+++ b/unicorn_mode/samples/python_simple/sample_inputs/sample1.bin
diff --git a/unicorn_mode/samples/simple/sample_inputs/sample2.bin b/unicorn_mode/samples/python_simple/sample_inputs/sample2.bin
index f76dd238..f76dd238 100644
--- a/unicorn_mode/samples/simple/sample_inputs/sample2.bin
+++ b/unicorn_mode/samples/python_simple/sample_inputs/sample2.bin
Binary files differdiff --git a/unicorn_mode/samples/simple/sample_inputs/sample3.bin b/unicorn_mode/samples/python_simple/sample_inputs/sample3.bin
index 6b2aaa76..6b2aaa76 100644
--- a/unicorn_mode/samples/simple/sample_inputs/sample3.bin
+++ b/unicorn_mode/samples/python_simple/sample_inputs/sample3.bin
diff --git a/unicorn_mode/samples/simple/sample_inputs/sample4.bin b/unicorn_mode/samples/python_simple/sample_inputs/sample4.bin
index 71bd63e6..71bd63e6 100644
--- a/unicorn_mode/samples/simple/sample_inputs/sample4.bin
+++ b/unicorn_mode/samples/python_simple/sample_inputs/sample4.bin
diff --git a/unicorn_mode/samples/simple/sample_inputs/sample5.bin b/unicorn_mode/samples/python_simple/sample_inputs/sample5.bin
index aed2973e..aed2973e 100644
--- a/unicorn_mode/samples/simple/sample_inputs/sample5.bin
+++ b/unicorn_mode/samples/python_simple/sample_inputs/sample5.bin
diff --git a/unicorn_mode/samples/simple/simple_target.bin b/unicorn_mode/samples/python_simple/simple_target.bin
index 0095eb6c..0095eb6c 100644
--- a/unicorn_mode/samples/simple/simple_target.bin
+++ b/unicorn_mode/samples/python_simple/simple_target.bin
Binary files differdiff --git a/unicorn_mode/samples/simple/simple_target.c b/unicorn_mode/samples/python_simple/simple_target.c
index 49e1b4d8..49e1b4d8 100644
--- a/unicorn_mode/samples/simple/simple_target.c
+++ b/unicorn_mode/samples/python_simple/simple_target.c
diff --git a/unicorn_mode/samples/simple/simple_test_harness.py b/unicorn_mode/samples/python_simple/simple_test_harness.py
index cd04ad3a..8758192e 100644
--- a/unicorn_mode/samples/simple/simple_test_harness.py
+++ b/unicorn_mode/samples/python_simple/simple_test_harness.py
@@ -10,7 +10,7 @@
 
    Run under AFL as follows:
 
-   $ cd <afl_path>/unicorn_mode/samples/simple/
+   $ cd <afl_path>/unicorn_mode/samples/python_simple
    $ ../../../afl-fuzz -U -m none -i ./sample_inputs -o ./output -- python simple_test_harness.py @@ 
 """
 
@@ -19,7 +19,7 @@ import os
 import signal
 
 from unicornafl import *
-from unicornafl.mips_const import *
+from unicorn.mips_const import *
 
 # Path to the file containing the binary to emulate
 BINARY_FILE = os.path.join(
@@ -156,7 +156,7 @@ def main():
         uc.mem_write(DATA_ADDRESS, input)
 
     # Start the fuzzer.
-    uc.afl_fuzz(args.input_file, place_input_callback, [end_address])
+    uc_afl_fuzz(uc=uc, input_file=args.input_file, place_input_callback=place_input_callback, exits=[end_address])
 
 
 if __name__ == "__main__":
diff --git a/unicorn_mode/samples/simple/simple_test_harness_alt.py b/unicorn_mode/samples/python_simple/simple_test_harness_alt.py
index 3249b13d..5fb3f82f 100644
--- a/unicorn_mode/samples/simple/simple_test_harness_alt.py
+++ b/unicorn_mode/samples/python_simple/simple_test_harness_alt.py
@@ -13,7 +13,7 @@
 
    Run under AFL as follows:
 
-   $ cd <afl_path>/unicorn_mode/samples/simple/
+   $ cd <afl_path>/unicorn_mode/samples/python_simple
    $ ../../../afl-fuzz -U -m none -i ./sample_inputs -o ./output -- python simple_test_harness_alt.py @@ 
 """
 
diff --git a/unicorn_mode/samples/speedtest/README.md b/unicorn_mode/samples/speedtest/README.md
index bd5ba8d0..f46a5772 100644
--- a/unicorn_mode/samples/speedtest/README.md
+++ b/unicorn_mode/samples/speedtest/README.md
@@ -5,7 +5,11 @@ to show the raw speed of C, Rust, and Python harnesses.
 
 ## Compiling...
 
-Make sure, you built unicornafl first (`../../build_unicorn_support.sh`).
+Make sure you built unicornafl first (`../../build_unicorn_support.sh`).
+Build the target using the provided Makefile.
+This will also run the [./get_offsets.py](./get_offsets.py) script,
+which finds some relevant addresses in the target binary using `objdump`,
+and dumps them to different files.
 Then, follow these individual steps:
 
 ### Rust
@@ -13,7 +17,7 @@ Then, follow these individual steps:
 ```bash
 cd rust
 cargo build --release
-../../../afl-fuzz -i ../sample_inputs -o out -- ./target/release/harness @@
+../../../../afl-fuzz -i ../sample_inputs -o out -U -- ./target/release/harness @@
 ```
 
 ### C
@@ -21,52 +25,16 @@ cargo build --release
 ```bash
 cd c
 make
-../../../afl-fuzz -i ../sample_inputs -o out -- ./harness @@
+../../../../afl-fuzz -i ../sample_inputs -o out -U -- ./harness @@
 ```
 
 ### python
 
 ```bash
 cd python
-../../../afl-fuzz -i ../sample_inputs -o out -U -- python3 ./harness.py @@
+../../../../afl-fuzz -i ../sample_inputs -o out -U -- python3 ./harness.py @@
 ```
 
 ## Results
 
 TODO: add results here.
-
-## Compiling speedtest_target.c
-
-You shouldn't need to compile simple_target.c since a X86_64 binary version is
-pre-built and shipped in this sample folder. This file documents how the binary
-was built in case you want to rebuild it or recompile it for any reason.
-
-The pre-built binary (simple_target_x86_64.bin) was built using -g -O0 in gcc.
-
-Then load the binary and execute the main function directly.
-
-## Addresses for the harness
-
-To find the address (in hex) of main, run:
-
-```bash
-objdump -M intel -D target | grep '<main>:' | cut -d" " -f1
-```
-
-To find all call sites to magicfn, run:
-
-```bash
-objdump -M intel -D target | grep '<magicfn>$' | cut -d":" -f1
-```
-
-For malloc callsites:
-
-```bash
-objdump -M intel -D target | grep '<malloc@plt>$' | cut -d":" -f1
-```
-
-And free callsites:
-
-```bash
-objdump -M intel -D target | grep '<free@plt>$' | cut -d":" -f1
-```
\ No newline at end of file
diff --git a/unicorn_mode/samples/speedtest/c/Makefile b/unicorn_mode/samples/speedtest/c/Makefile
index 46789954..d34f49fa 100644
--- a/unicorn_mode/samples/speedtest/c/Makefile
+++ b/unicorn_mode/samples/speedtest/c/Makefile
@@ -4,29 +4,28 @@
 .POSIX:
 UNAME_S =$(shell uname -s)# GNU make
 UNAME_S:sh=uname -s       # BSD make
-_UNIQ=_QINU_
 
-LIBDIR = ../../../unicornafl
+UNICORNAFL_LIB = ../../../unicornafl/build
+UNICORN_LIB = ../../../unicornafl/unicorn/build
 BIN_EXT =
 AR_EXT = a
 
 # Verbose output?
 V ?= 0
 
-CFLAGS += -Wall -Werror -Wextra -Wno-unused-parameter -I../../../unicornafl/include
+CFLAGS += -Wall -I../../../unicornafl/unicorn/include -I../../../unicornafl/include
 
-LDFLAGS += -L$(LIBDIR) -lpthread -lm
+LDFLAGS += -L$(UNICORNAFL_LIB) -L$(UNICORN_LIB) -lpthread -lm -lunicornafl -lunicorn -lc++
 
-_LRT = $(_UNIQ)$(UNAME_S:Linux=)
-__LRT = $(_LRT:$(_UNIQ)=-lrt)
-LRT = $(__LRT:$(_UNIQ)=)
+ifeq ($(UNAME), Linux)
+# do something Linux-y
+LRT = -lrt
+else
+LRT = 
+endif
 
 LDFLAGS += $(LRT)
 
-_CC = $(_UNIQ)$(CROSS)
-__CC = $(_CC:$(_UNIQ)=$(CC))
-MYCC = $(__CC:$(_UNIQ)$(CROSS)=$(CROSS)gcc)
-
 .PHONY: all clean
 
 all: ../target harness
@@ -38,17 +37,20 @@ afl-fuzz: ../../../../afl-fuzz
 clean:
 	rm -rf *.o harness harness-debug
 
-harness.o: harness.c ../../../unicornafl/include/unicorn/*.h
-	${MYCC} ${CFLAGS} -O3 -c harness.c -o $@
+../../../unicornafl/build/libunicornafl.a:
+	cd ../../.. && ./build_unicorn_support.sh
+
+harness.o: harness.c ../../../unicornafl/unicorn/include/unicorn/*.h
+	${CC} ${CFLAGS} -O3 -c harness.c -o $@
 
-harness-debug.o: harness.c ../../../unicornafl/include/unicorn/*.h
-	${MYCC} ${CFLAGS} -fsanitize=address -g -Og -c harness.c -o $@
+harness-debug.o: harness.c ../../../unicornafl/unicorn/include/unicorn/*.h
+	${CC} ${CFLAGS} -fsanitize=address -g -Og -c harness.c -o $@
 
 harness: harness.o
-	${MYCC} -L${LIBDIR} harness.o ../../../unicornafl/libunicornafl.a $(LDFLAGS) -o $@
+	${CC} harness.o $(LDFLAGS) -o $@
 
 harness-debug: harness-debug.o
-	${MYCC} -fsanitize=address -g -Og -L${LIBDIR} harness-debug.o ../../../unicornafl/libunicornafl.a $(LDFLAGS) -o harness-debug
+	${CC} -fsanitize=address -g -Og harness-debug.o ../../../unicornafl/libunicornafl.a $(LDFLAGS) -o harness-debug
 
 ../target:
 	$(MAKE) -C ..
diff --git a/unicorn_mode/samples/speedtest/c/harness.c b/unicorn_mode/samples/speedtest/c/harness.c
index e8de3d80..184934b9 100644
--- a/unicorn_mode/samples/speedtest/c/harness.c
+++ b/unicorn_mode/samples/speedtest/c/harness.c
@@ -8,9 +8,9 @@
 
    Run under AFL as follows:
 
-   $ cd <afl_path>/unicorn_mode/samples/simple/
+   $ cd <afl_path>/unicorn_mode/samples/speedtest/c
    $ make
-   $ ../../../afl-fuzz -m none -i sample_inputs -o out -- ./harness @@
+   $ ../../../../afl-fuzz -i ../sample_inputs -o out -U -- ./harness @@
 */
 
 // This is not your everyday Unicorn.
@@ -28,6 +28,7 @@
 #include <sys/mman.h>
 
 #include <unicorn/unicorn.h>
+#include <unicornafl/unicornafl.h>
 
 // Path to the file containing the binary to emulate
 #define BINARY_FILE ("../target")
@@ -124,7 +125,7 @@ static void mem_map_checked(uc_engine *uc, uint64_t addr, size_t size, uint32_t
     //printf("SIZE %llx, align: %llx\n", size, ALIGNMENT);
     uc_err err = uc_mem_map(uc, addr, size, mode);
     if (err != UC_ERR_OK) {
-        printf("Error mapping %ld bytes at 0x%lx: %s (mode: %d)\n", size, addr, uc_strerror(err), mode);
+        printf("Error mapping %ld bytes at 0x%llx: %s (mode: %d)\n", (unsigned long) size, (unsigned long long) addr, uc_strerror(err), (int) mode);
         exit(1);
     }
 }
@@ -306,7 +307,7 @@ int main(int argc, char **argv, char **envp) {
         exit(-1);
     }
     uint64_t start_address;
-    if(fscanf(f, "%lx", &start_address) == EOF) {
+    if(fscanf(f, "%llx", (unsigned long long) &start_address) == EOF) {
         puts("Start address not found in target.offests.main");
         exit(-1);
     }
diff --git a/unicorn_mode/samples/speedtest/rust/Cargo.toml b/unicorn_mode/samples/speedtest/rust/Cargo.toml
index 9b81be0b..766b2f27 100644
--- a/unicorn_mode/samples/speedtest/rust/Cargo.toml
+++ b/unicorn_mode/samples/speedtest/rust/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "unicornafl_harness"
+name = "harness"
 version = "0.1.0"
 authors = ["Dominik Maier <domenukk@gmail.com>"]
 edition = "2018"